A production certificate expires on a Thursday afternoon. Nobody notices, because the billing system carries on exactly as before. PDFs still print. QR codes still render. Sales keeps selling.
What stopped is clearance. Every standard invoice that should have gone to Fatoora for approval before reaching the buyer is sitting in a queue nobody watches, and none of those documents is legally a tax invoice.
That’s the shape of most Fatoora problems we get called into. Not defiance, not a decision to ignore anything. A certificate, a firewall change, an ERP upgrade that quietly broke the signing step. The fine is rarely the expensive part of it.
ZATCA dropped Article 45 fines from the amnesty on 30 June 2026
On 29 June 2026 the Zakat, Tax and Customs Authority announced that the Minister of Finance had extended the Cancellation of Fines and Exemption of Financial Penalties Initiative for another six months, running to 31 December 2026. Most finance teams read the headline, saw the date, and moved on.
The announcement lists what’s covered. Late registration across all tax laws, late payment, late filing of returns, and VAT return correction fines. Then it lists exclusions. Tax evasion penalties, fines already paid before the initiative took effect, penalties tied to any return falling due after 30 June 2026, and fines imposed under Article 45 of the VAT Law.
Article 45 is the clause e-invoicing field violations are assessed under.
Set that against how the same initiative was described in earlier rounds. KPMG’s alerts on both the 2023 and the 2024 extensions listed VAT field detections and e-invoicing regulation violations among the covered categories, explicitly. Previous versions of ZATCA’s own simplified guideline named e-invoicing under Article 45 as included.
So the language moved. Whether that’s a deliberate narrowing or a drafting difference, we honestly can’t tell you from the public text alone, and some commentary published since June still describes the current window as covering e-invoicing violations. What we can tell you is that an assumption formed in 2024 is a bad thing to bet exposure on. If you’re carrying unresolved Fatoora violations and you were planning to clear them under the waiver, call 19993 and get it confirmed in writing before December.
One more line in that announcement is worth reading properly. Even if the initiative gets extended past December, it will not reach back to cover fines on any return that fell due after 30 June 2026. That door is shut regardless of what happens next.
Your customer loses the 15% input VAT on an invoice that didn't clear
Once you’re past your wave deadline, an invoice that never cleared Fatoora isn’t a valid tax document. Your customer can’t recover input VAT against it. On a SAR 400,000 contract that’s SAR 60,000 they absorb, or more likely SAR 60,000 they come back to you about.
Large buyers in the Kingdom have adapted already. Accounts payable checks clearance status before releasing payment, and a supplier whose documents keep failing validation gets flagged internally well before anyone at that supplier hears a word about it. This is the version of the cost nobody budgets for, because it never arrives as a penalty notice. It arrives as a renewal that doesn’t happen.
It runs the other direction too. A supplier past their own deadline who sends you a Phase 1 document leaves you unable to claim, so a standing clearance check belongs inside your accounting workflow rather than being argued case by case.
Then there’s reconciliation. When clearance stops for a stretch and nobody catches it, you get a gap between what the ERP thinks it issued and what the authority holds, and closing that means credit notes, reissued documents, a corrected return. Three weeks of drift runs into six figures of finance-team time before any penalty is assessed. Comparing the two ledgers automatically rather than at quarter end is a data engineering problem more than an accounting one.
The fine schedule runs from a written notice up to forty thousand riyals
The authority reclassified field violations in a decision effective 30 January 2022, and that reclassification is still what inspectors work from. The first time something is found on site, you get a notice and a window to correct it. Money enters after that.
| Where you are in the cycle | What gets applied |
|---|---|
|
First detection during a field visit |
Written notice plus a correction period |
|
Second occurrence within 12 months |
SAR 1,000 |
|
Third
|
SAR 5,000 |
|
Fourth |
SAR 10,000 |
|
Fifth and beyond |
SAR 40,000 |
Twelve clean months on a given violation type resets that clock to the notice stage. Each type climbs its own track, so a missing QR code and a missing buyer VAT number escalate separately. A warning letter isn’t a reprieve, it starts the clock.
The ceiling figures you see quoted everywhere come from somewhere else. The authority’s original violations announcement, published ahead of the 4 December 2021 Phase 1 start, put non-issuance and non-archiving in a SAR 5,000 to 50,000 band and post-issuance deletion at SAR 10,000 upward. Both sets are real. One is the statutory range, the other is what gets written on the field report.
Published summaries disagree on this badly, and several state a ladder topping out at SAR 50,000 with complete confidence. Check anything you plan to budget against the current guideline on zatca.gov.sa. There’s a second gap underneath all of it: nothing published says clearly whether penalties apply per invoice or per tax period. Deloitte flagged that when the original schedule came out and it hasn’t been settled since. Issue at volume and you should estimate against the worse reading.
Most breakages are certificate expiry, hash gaps, and missed reporting windows
The technical failure modes cluster tighter than people expect, and almost all of them are silent.
Cryptographic stamp identifiers issued through Fatoora have a finite life, and unlike a TLS certificate on a public site, nothing external goes red when one lapses. Your monitoring probably isn’t watching it. Onboarding was done once, by someone who may have left, using an OTP from a portal login that sits with a single person.
Counter values and the previous document hash have to stay continuous. An ERP restored from backup, a test environment pointed at production credentials, a parallel instance spun up mid-migration, any of these breaks the chain, and a broken chain is the category that opens at ten thousand rather than at a notice.
Simplified invoices carry a 24-hour reporting window. A POS that batches overnight and fails quietly on a Friday sits outside that window all weekend before anyone opens a log. High counter volume makes it worse, since one defect repeats a few thousand times before it’s spotted.
The target moves as well. The third version of the controls and technical specifications landed on 19 May 2026, so whatever you built against in 2023 is not current.
When a client asks us to look at a setup, we go through certificate state and expiry dates first, including whether renewal is somebody’s named job rather than an assumption. Then clearance success rate across ninety days rather than the last week, because drift hides in short averages. Then the gap between documents issued in the ERP and documents acknowledged by Fatoora, reconciled on count and on value. Then counter and hash continuity across every environment that can reach production credentials. Then reporting latency measured at the tail against the 24-hour rule, not at the median. Last, whether a validation failure raises an alert that a human actually sees, which is the one that fails most often. Nearly every business we’ve seen carrying penalty exposure had the data sitting there the whole time.
If a review turns something up, correct it before an inspector does. Nothing in the framework rewards waiting, and dated vendor contracts and support tickets are worth keeping as evidence of remediation. Teams on Odoo can usually wire this into the existing billing flow rather than bolting on a layer, and our Odoo practice handles that side. Where the logic lives in something older it turns into a software consulting engagement, or a digital transformation one if the underlying system can’t sign reliably at all. Either way it’s ordinary DevOps and cloud hygiene applied to something most teams still treat as accounting software instead of an integration with a government API.
Wave 25 Sets the Threshold at 187,500 Yiyals with a February 2027 Deadline
On 24 July 2026 the authority published criteria for the twenty-fifth wave, covering taxpayers whose VAT-subject revenue passed SAR 187,500 in 2022, 2023, 2024 or 2025, with integration due by 1 February 2027. Half the Wave 24 threshold of SAR 375,000.
Which means the businesses coming in next are small. Plenty are running an off-the-shelf package or a spreadsheet, and integration will be their first contact with XML signing and API credentials. Start early.
Ready to see what your Fatoora setup is actually doing
Most of the exposure we find isn’t in accounting. It’s in expired credentials, unmonitored queues, and reconciliation nobody runs. We work with businesses across Riyadh, Jeddah and the wider GCC on this kind of integration.
Talk to us and we’ll go through your setup with you. If it’s clean, we’ll tell you that.
Ready to Disrupt Digitally
Schedule your free consultation and start building smarter, scalable solutions.
What we do
What we Serve
Industries & Domains
- AI/ML-Driven Domains
- Business Accounting Services
- Disaster Relief Management
- Energy & Utilities
- Government & Public Sector
- Healthcare & Life Sciences
- Higher Education
- Hospitality & Travel
- Dubai, UAE (HQ)
- Abbu Dabi, UAE
- Riyadh, KSA
- Jeddah, KSA
Software Disruption – FZCO is a Dubai-based AI and data engineering company helping enterprises build scalable, data-driven software solutions across the GCC.
Company
Resource
Support
+971-557529787 | +92-3008299449
waqas@softwaredisruption.com
IFZA Business Park, DDP, PREMISES NO: 35039-001 Dubai